ScanMalware.com

Security Scan Report: 193.149.176.16

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/e74a8bcf-3004-490b-a20a-a1ffdaf87042Domain and IP registration (RDAP)/api/v1/rdap/e74a8bcf-3004-490b-a20a-a1ffdaf87042How often this domain was scanned/api/v1/domain/stats/193.149.176.16Scan history for this domain/api/v1/domain/history/193.149.176.16?limit=15
This website contacted 1 IP in 1 country across 1 domain to perform 3 HTTP transactions. The main domain is 193.149.176.16.

Submitted URL: http://193.149.176.16:8080/

AI Security Verdict

Confirmed Scam

Confidence: 96%

10
Risk Score

Roster-anchored CRITICAL hunting-rule hit identifies this page as the operator panel of the GhostFrame ESXi post-exploitation framework, complete with a hidden API-token field and 'Connect' control — live attacker C2 infrastructure.

Risk Factors (5)
CRITICAL hunting-rule match for the GhostFrame ESXi command-and-control operator panel
Analyst-vetted malicious kit roster identification (ghostframe-esxi-c2-panel-2026-11)
Hidden API-token password field without a username field
Hosted on a raw IP address with no registered domain or reputation
Content matches a documented post-exploitation framework linked to intrusions ending in Settra ransomware
Domain age information unavailable

Details

Page Title

GhostFrame

Scan Type

public

Domain Name Analysis

You're looking at domain '193.149.176.16:8080' on an unknown top-level domain. Count 14 characters in '193.149.176.16' holding 0 vowels versus zero consonants; bonus characters include eleven digits. Segmentation suggests four words: 193, 149, 176, 16. Average segment length settles at 3 characters. No strong language cues emerged from the frequency lists.

Screenshot

() GHOSTFRAME | API Token }

Page Load Overview

1.64s
Total Load Time
745 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:29 chars
Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
3193.149.176.16Chicago, Illinois, United States
AS399629BL Networks
31--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1A431AA417242055F91338BA8EE98FA14605FD718C609EC94912941BC42C2D42AD6A5AC

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

48:nBr6s/wbhBbPnDVqGc/DD34DaSHtMsM/j5:nBr6s/wbjfkV/DD3lj5

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:1624:BAAAAAAABIAUAAAAAAQAABAAwACACCIAAAAAAAAQAgBIQAIAAAIAAAAAACAAAAECAAABAAABAAgAAAAAhQgAIAABAAAKAAAk

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:0000001818000000
Perceptual Hash:cc663399cc663399
Difference Hash:0000083232080000
Wavelet Hash:00002c3c3c3c3030
Color Hash:38000000e00

Other Hashes

Crop Resistant:0000083232080000

Scan History

Scan history not available

Unable to load historical scan data